import { NextResponse } from "next/server";
import { prisma } from "@/lib/prisma";
import { requireRole } from "@/lib/auth";

/** The institution admin changes their own login password. */
export async function PUT(req: Request) {
  const session = await requireRole("INSTITUTION_ADMIN");
  if (!session) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });

  try {
    const body = await req.json();
    const currentPassword = String(body.currentPassword ?? "");
    const newPassword = String(body.newPassword ?? "");

    if (newPassword.length < 6) {
      return NextResponse.json({ error: "Password must be at least 6 characters" }, { status: 400 });
    }

    const user = await prisma.user.findUnique({
      where: { id: session.userId },
      select: { passwordHash: true },
    });
    if (!user) return NextResponse.json({ error: "Account not found" }, { status: 404 });

    const bcrypt = (await import("bcryptjs")).default;
    const matches = await bcrypt.compare(currentPassword, user.passwordHash);
    if (!matches) return NextResponse.json({ error: "INVALID_PASSWORD" }, { status: 400 });

    await prisma.user.update({
      where: { id: session.userId },
      data: { passwordHash: await bcrypt.hash(newPassword, 10) },
    });
    return NextResponse.json({ ok: true });
  } catch {
    return NextResponse.json({ error: "Could not change password" }, { status: 500 });
  }
}